SSL Medium and RC4 Ciphers supported

[sveeke]

The badgr-dev2.edubadges.nl webserver supports insecure Medium and RC4 ciphers.

[sveeke]

threatLevel="Moderate" type="Insecure SSL/TLS Configuration"

The badgr-dev2.edubadges.nl webserver supports insecure Medium DES-CBC3-SHA, RC4-MD5 and RC4-SHA ciphers.

The testssl.sh (www.testssl.sh) was used to find the issues.

./testssl.sh badgr-dev2.edubadges.nl

 Triple DES Ciphers (Medium)                   offered
 Weak 128 Bit ciphers (SEED, IDEA, RC[2,4])    offered (NOT ok)

impact:
Using Medium-Grade-Ciphers and RC4 makes it easier to attack connections or decrypt the encrypted traffic.

recommendation:
Disable the use of the insecure Medium DES-CBC3-SHA, RC4-MD5 and RC4-SHA ciphers.